GitLab on Monday patched two GraphQL flaws in Community Edition and Enterprise Edition, including CVE-2026-19478, a critical issue that watchTowr said it could reproduce within minutes of disclosure. The fixes cover self-managed GitLab 18.11.11, 19.0.8, 19.1.6, and 19.2.4, while GitLab.com and GitLab Dedicated were already updated.
The critical bug lets an unauthenticated attacker abuse a GraphQL directive to change or delete public project data and user data. The second flaw, CVE-2026-19650, is a cross-site request forgery problem in GraphQL multiplex handling: a request that looks like a GET can still be processed as a mutation when validation goes wrong, so the server accepts state changes it should have refused.
For teams running their own GitLab, the exposure sits at the API layer, not the login page. If GitLab is internet-facing, the immediate concern is integrity: repositories, project records, and user data can be rewritten or removed without credentials, and the speed of public reproduction makes rapid weaponization a near-term risk.